Block-wise Codeword Embedding for Reliable Multi-bit Text Watermarking

• URL: http://arxiv.org/abs/2605.00348v1
• Date: Fri, 01 May 2026 02:14:38 GMT
• Title: Block-wise Codeword Embedding for Reliable Multi-bit Text Watermarking
• Abstract summary: We present textbfBREW (Block-wise Reliable Embedding for Watermarking), a framework shifting the paradigm to emphdesignated verification.<n>Our framework is model-agnostic and theoretically grounded, providing a scalable solution for reliable forensic deployment.
• Score: 1.534847923698733
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Recent multi-bit watermarking methods for large language models (LLMs) prioritize capacity over reliability, often conflating decoding with detection. Our analysis reveals that existing ECC-based extractors suffer from catastrophic false positive rates (FPR), and applying rejection thresholds merely collapses detection sensitivity (TPR) to random guessing. To resolve this structural limitation, we propose \textbf{BREW} (Block-wise Reliable Embedding for Watermarking), a framework shifting the paradigm to \emph{designated verification}. BREW employs a two-stage mechanism: (i) \textbf{blind message estimation} via independent block voting, followed by (ii) \textbf{window-shifting verification} that rigorously validates the payload against local edits. Experiments demonstrate that BREW achieves a TPR of 0.965 with an FPR of 0.02 under 10\% synonym substitution, demonstrating that the high-FPR issue is not an inherent trade-off of multi-bit watermarking, but a solvable structural flaw of prior decoding-centric designs. Our framework is model-agnostic and theoretically grounded, providing a scalable solution for reliable forensic deployment.

Related papers

• PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution [83.66032773976904]
  We present PURA, a provably unbiased and robust multi-bit watermarking method for text attribution.<n>Instead of perturbing token probabilities directly, PURA embeds payloads in the latent sampling space via keyed inverse transform sampling.<n>We show that PURA substantially outperforms existing unbiased baselines in the high-payload regime.
  arXiv  Detail & Related papers  (2026-08-23T04:44:27Z)
• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought [22.88615312532184]
  BiCoT is a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces.<n>To enable verification under model theft and representation drift, we introduce Robust Subspace Registration.<n> Experiments show that BiCoT preserves reasoning fidelity across diverse complex reasoning tasks.
  arXiv  Detail & Related papers  (2026-05-27T07:44:38Z)
• VOW: Verifiable and Oblivious Watermark Detection for Large Language Models [4.920744236528847]
  We propose a new protocol that achieves both privacy-preserving and cryptographically verifiable watermark detection.<n>VOW is practical for short texts and provides a crucial reassessment of watermark robustness against modern paraphrasing attacks.
  arXiv  Detail & Related papers  (2026-04-30T10:02:18Z)
• Rethinking LLM Watermark Detection in Black-Box Settings: A Non-Intrusive Third-Party Framework [16.430415006488865]
  TTP-Detect is a pioneering black-box framework designed for non-intrusive, third-party watermark verification.<n>It employs a proxy model to amplify watermark-relevant signals and a suite of complementary relative measurements to assess the alignment of the query text with watermarked distributions.<n>It achieves superior detection performance and robustness against diverse attacks.
  arXiv  Detail & Related papers  (2026-03-16T08:28:48Z)
• CORE: Context-Robust Remasking for Diffusion Language Models [51.59514489363897]
  We propose Context-Robust Remasking (CORE), a training-free framework for inference-time revision.<n>Rather than trusting static token probabilities, CORE identifies context-brittle tokens by probing their sensitivity to targeted masked-context perturbations.<n>On LLaDA-8B-Base, CORE delivers consistent improvements across reasoning and code benchmarks, outperforming compute-matched baselines and improving MBPP by up to 9.2 percentage points.
  arXiv  Detail & Related papers  (2026-02-04T00:12:30Z)
• SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarking [58.475471437150674]
  We propose sequential watermarking for soft prompts (SWAP)<n>SWAP encodes watermarks through a specific order of defender-specified out-of-distribution classes.<n>Experiments on 11 datasets demonstrate SWAP's effectiveness, harmlessness, and robustness against potential adaptive attacks.
  arXiv  Detail & Related papers  (2025-11-05T13:48:48Z)
• Optimal Detection for Language Watermarks with Pseudorandom Collision [28.84134119819056]
  We introduce a statistical framework that captures structure through a hierarchical two-layer partition.<n>At its core is the concept of minimal units -- the smallest groups treatable as independent across units while permitting dependence within.<n>Applying to Gumbel-max and inverse-transform watermarks, our framework produces closed-form optimal rules.
  arXiv  Detail & Related papers  (2025-10-24T20:21:52Z)
• Do LLMs Know They Are Being Tested? Evaluation Awareness and Incentive-Sensitive Failures in GPT-OSS-20B [1.948261185683419]
  We investigate whether "evaluation scent" inflates measured performance without commensurate capability gains.<n>We run six paired A/B scenarios that hold task content and decoding fixed while varying framing.<n>We provide a reproducible A/B framework (prompt banks, validators, per-run scores, scripts) and practical guidance.
  arXiv  Detail & Related papers  (2025-10-08T09:49:05Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints [49.2373408329323]
  We introduce a new theoretical framework on watermark-leveling (SWM) for large language models (LLMs)<n>We propose PMark, a simple yet powerful SWM method that estimates the median next sentence dynamically through sampling channels.<n> Experimental results show that PMark consistently outperforms existing SWM baselines in both text quality and paraphrasing.
  arXiv  Detail & Related papers  (2025-09-25T12:08:31Z)
• StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models [55.05404953041403]
  We propose a novel framework that seamlessly integrates a binary watermark into the diffusion generation process.<n>We show that StableGuard consistently outperforms state-of-the-art methods in image fidelity, watermark verification, and tampering localization.
  arXiv  Detail & Related papers  (2025-09-22T16:35:19Z)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach [53.32564762183639]
  We introduce a novel, unified theoretical framework for watermarking Large Language Models (LLMs)<n>Our approach aims to maximize detection performance while maintaining control over the worst-case false positive rate (FPR) and distortion on text quality.<n>We propose a distortion-free, distribution-adaptive watermarking algorithm (DAWA) that leverages a surrogate model for model-agnosticism and efficiency.
  arXiv  Detail & Related papers  (2024-10-03T18:28:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.